The private key is a red herring, it is not used for "encryption" as such.
The certs are used to validate website identity, whereupon key agreement is performed to establish a symmetric key that has nothing whatsoever to do with your certificate.
All that matters here-- all that we use the keypair for-- is to prove that each party "is who they say they are", and that is something your CA can lie about.
If a layperson understands,
able to issue arbitrary certificates that an arbitrary browser will trust
as
has the secret codes to everyone’s encryption
...then they're close enough, without digging into the RFCs, codicils, addendums, etc. They can perform a MITM, which is the literal thing that our PKI/TLS system is supposed to guarantee cannot happen.
The certs are used to validate website identity, whereupon key agreement is performed to establish a symmetric key that has nothing whatsoever to do with your certificate.
All that matters here-- all that we use the keypair for-- is to prove that each party "is who they say they are", and that is something your CA can lie about.
If a layperson understands,
as ...then they're close enough, without digging into the RFCs, codicils, addendums, etc. They can perform a MITM, which is the literal thing that our PKI/TLS system is supposed to guarantee cannot happen.